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DIR Opening Remarks Guidance for DPI 

The DIR typically gives Opening Remarks for the following three conferences 
(NORUSA, DENUSA, and SWEDUSA) but he may be asked to do others in which 
case the same guidance should be followed. 

DIR Staff has given us guidelines to follow for the Opening Remarks Talking 
Points. Note that we had wanted to simply include these Opening Remarks 
Talking Points in our Exec Sum for the visit, but DIR Staff told us they needed a 
separate document for the Opening Remarks and it needed to be in a specific 
format. That format is below (example provided is from DENUSA last year). 

The Remarks should outline things that have been accomplished since the last 
conference, as well as things we want to get accomplished in this 
conference/the upcoming year. We should also add anything else FAD wants 
DIRNSA to convey. 

Once the Opening Remarks Talking Points are approved by appropriate DPI 
leadership (at least DPI Office Chief level), the CDO should provide the Opening 
Remarks in the attached format to the following aliases at least 3 business days 
in advance of the event: 

TO: DL DIRSPEAK 

CC: D DIR Staff, DPI Office Chief/Deputy 

Per guidance from DIR Staff, it is the responsibility of the folks on the 
DIRCOMMS alias to print out the remarks on 5X8 cards and provide to 
the DIR staff. 



(Updated on 3/4/2013) 
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DENUSA 
6-8 June 



(S//REL TO USA, DNK) Thank the Danes for their 
wonderful hospitality they extended to you and your 
delegation during your March visit to Copenhagen. 




(TS//SI//REL TO USA, DNK) Emphasize NSA's 
commitment to the special access and assisting DDIS in 
managing the access. 

Remind the Danes of the long NSA-DDIS partnership 
working cable access with. 

Note that we look forward to new areas of 
cooperation. 

(TS//REL TO USA, DNK) Highlight that NSA is willing to 
engage with DDIS on cyber defense. 



SECRET//RELTO USA, AUS, CAN, GBR, NZL 
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We believe that furthering our cooperation will be 
mutually beneficial to our two nations. 




(S//REL TO USA, DNK) Stress that Denmark is a very 
trusted, capable party. 



We value that partnership and we are pleased to be 
moving forward with DDIS on critical target areas. 

We believe that furthering our cooperation will be 
mutually beneficial to our two nations. 
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(U) SPECIAL SOURCE ACCESS 
(U) FOREIGN PARTNER ACCESS 



This Exhibit is SECRET//NOFORN 




FY2011 1 

Actual 


FY 2012 Enacted 


FY 2013 Request 


FY 2012 - FY 2013 


Base 


OCO 


Total 


Base 


OCO 


Total 


Change 


% 

Change 


Funding ($M) 


91.0 


75.1 


- 


75.1 


52.6 


4.0 


56.6 


-18.5 


-25 


Civilian FTE 


33 


57 


- 


57 


57 


- 


57 


- 


- 


Civilian Positions 


33 


57 


- 


57 


57 


- 


57 


- 


- 


Military Positions 


- 


- 


- 


- 


- 


- 


- 


- 


- 


1 Includes enacted OCO funding. Totals may not add due to rounding. 



(U) Project Description 

(U//FOUO) The Foreign Partner Access Project contains two major programs - RAMPART- A and 
WINDSTOP. 

(TS//SI//NF) The RAMP ART- A program provides collection against long-haul international leased 
communications through special access initiatives with world- wide SIGINT partnerships. RAMP ART- A 
employs TURMOIL capabilities, provided by the Net-Centric Capabilities (NCC) Project in the Mission 
Processing & Exploitation Expenditure Center. Additional NCC efforts will address the processing challenges 
of the volume, velocity, and variety of data present at the RAMPART- A sites. RAMPART-A has access to over 
3 Terabits per second of data streaming world-wide and encompasses all communication technologies such as 
voice, fax, telex, modem, e-mail internet chat, Virtual Private Network (VPN), Voice over IP (VoIP), and voice 
call records. 

(TS//SI//NF) The WINDSTOP program focuses on second party relationships. WINDSTOP currently partners 
with all the second parties, but primarily the United Kingdom (UK), to develop a well-integrated, over- arching 
architecture to utilize unprecedented access to communications into and out of Europe and the Middle East. 
Collection capabilities include Digital Network Intelligence processing and selection capabilities for e-mail, web, 
Internet chat, and VoIP. 

(TS//SI//REL TO USA, FVEY) This Project supports the Comprehensive National Cybersecurity 
Initiative (CNCI) by enhancing capabilities that identify emerging threats and vulnerabilities to US 
communication systems. This Project contains the RAMPART-A Modernization, RAMPART-A Operations and 
WINDSTOP Sub-Projects. 

(U) Base resources in this project are used to: 

• (TS//SI//NF) Provide annual upgrades to system capabilities at existing Foreign Partner collection sites to 
keep pace with the rapidly changing telecommunications field. 

• (TS//SI//REL TO USA, FVEY) Provide access and collection against international high-priority target 



• (S//SI//REL TO USA, FVEY) Support continuing requirements of infrastructure and communications 
improvements within the Foreign Partner collection sites to collect high speed Digital Network Intelligence, 
voice, fax, telex, e-mail, internet chat, VPN, and VoIP communications. 
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• (TS//SI//REL TO USA, FVEY) Support CNCI by ensuring that data stores are produced, common collection 
system analytic techniques are developed, adequate infrastructure is built for increased processing, and 
enhanced collection tasks in support of cyber defense are implemented to meet the operational needs 
and satisfy agreements for collection and processing at selected Foreign Partner collection sites using 
TURMOIL collection systems. 

(U) There are no new activities in this Project for FY 2013. 

(U) OCO resources in this project are used to: 

• (TS//SI//NF) Provide contracted services and equipment for upgrades on a processing suite at a 
RAMPART- A site. The upgrade will exploit the latest technologies present in 

networks and consists of the design, procurement, integration, testing and deployment of advanced 
processing capabilities hosted on the latest server technologies. 

(U) The CCP expects this Project to accomplish the following in FY 2013: 

• (S//SI//REL TO USA, FVEY) Expand collection and processing capabilities resulting from joint 
collaboration efforts and shared access initiatives to leverage the highly lucrative NS A/CSS Second Party 
access and to exploit high speed Digital Network Intelligence. 

• (TS//SI//REL TO USA, FVEY ) Complete the deployment of NCC Increment 2 and 3 defensive software 
applications in support of the CNCI interconnected network of sensors. 

• (S//SI//REL TO USA, FVEY) Support and expand the TURMOIL-based foreign site processing systems 
in order to exploit high-speed Digital Network Intelligence. Support the continuing requirements of 
infrastructure and communications improvements to RAMPART- A and WINDSTOP that will provide 
exploitation of high speed Digital Network Intelligence. 

• (TS//SI//NF) Integrate Third Party releasable Dialed Number Recognition and Digital Network Intelligence 
collection systems upgrades, developed by NS A/CSS, within the RAMP ART- A site architecture. The new 
capabilities will enable increased collection of communications available at each RAMPART- A site. 

• (TS//SI//REL TO USA, FVEY) Upgrade collection capabilities at each site to increase intelligence 
production. 

• (TS//SI//NF) Develop additional access to communications links at each RAMPART-A site. This additional 
access will increase the amount of international network coverage available for intelligence exploitation. 

• (TS//SI//NF) Develop one new Foreign Partner relationship that will enable NSA/CSS to access 
international communications of high interest for intelligence exploitation. 

• (TS//SI//NF) Deploy, operate, or refresh systems to implement key CNCI goals against increasingly 
complex communication signals at five RAMPART-A sites and two WINDSTOP sites. 

(U) Changes From FY 2012 to FY 2013: 

(S//NF) WINDSTOP: -$17.8 million (-$17.8 Base). The aggregate decrease is the result of: 

• (U) Increases: 

— (S//SI//NF) $1.0 million to sustain the current level of operations and accesses with its Second-Party 
partners. 

— (S//SI//NF) $0.9 million for increased sustainment cost of current operations and Second-Party 
relationships. 
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— (S//NF) $0.1 million in civilian pay and benefits. 

• (U) Decreases: 

— (S//SI//NF) $19.1 million reduces NSA/CSS' ability to deliver shared access opportunities at the scale 
originally envisioned. 

— (TS//SI//NF) $0.7 million for deficit reduction and reduces NSA/CSS' ability to expand tasking of 

new high priority targets at 2nd party 

UK accesses, thus limiting NSA/CSS' flexibility to optimize the current set of tasked signals. 

(S//NF) RAMPART - A Modernization: -$0.5 million (-$0.5 Base). The aggregate decrease is the result of: 

• (U) Increases: 

— (S//NF) $0.1 million in civilian pay and benefits. 

• (U) Decreases: 

— (S/SI//NF) $0.6 million in equipment purchased for the sustainment of critical RAMPART-A foreign 
partner sites. 

(S//NF) RAMPART - A Operations: -$0.3 million (-$4.3 Base, +$4 OCO). The aggregate decrease is the 
result of: 

• (U) Increases: 

— (TS//SI//NF) $4.0 million Overseas Contingency Operations (OCO) provides an upgrade to the 

processing suite at one RAMP ART- A's foreign partner site, which will exploit the latest technologies 
present in networks. This upgrade consists of the design, procurement, 

integration, testing and deployment of advanced processing capabilities hosted on the latest server 
technology. 

— (S//SI//NF) $1.3 million reflects the refreshment of collection equipment at one foreign partner site. 

— (S//NF) $0.3 million in civilian pay and benefits. 

• (U) Decreases: 

— (S/SI//NF) $5.9 million reflects the planned completion of additional site preparations for the 
deployment of TURMOIL systems. 
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Foreign Partner Access Project Budget Chart 
FY 2013 Budget Request by Appropriation Account 
This Exhibit is SECRET//NOFORN 


Funds — Dollars in Millions 


Subproject 


Description 


Resourcing 


FY 2011 


FY 2012 


FY 2013 


Operation and Maintenance, Defense-Wide 


Funds 


73.96 


69.12 


51.17 


Positions 


33 


57 


57 


RAMPART - A Modernization 


Pay and Benefits 


Base 


2.18 


2.45 


2.53 




Positions 


16 


18 


18 


RAMPART - A Operations 


Communications and Utilities 


Base 


2.37 


2.24 


0.65 


Contract Services 


Base 


38.88 


25.26 


22.31 


Equipment 


Base 


13.60 


5.45 


5.47 


OCO 


- 


- 


4.00 


Pay and Benefits 


Base 


1.81 


4.71 


4.98 


Rental Payments 


Base 


- 


0.34 


0.34 


Supplies and Materials 


Base 


<0.01 


0.11 


0.10 


Travel and Transportation 


Base 


0.68 


0.39 


0.39 




Positions 


15 


36 


36 


WINDSTOP 


Contract Services 


Base 


13.84 


25.85 


9.90 


Equipment 


Base 


0.26 


1.91 


- 


Pay and Benefits 


Base 


0.27 


0.41 


0.42 


Travel and Transportation 


Base 


0.07 


- 


0.08 




Positions 


2 


3 


3 


Procurement, Defense-Wide 


Funds 


17.01 


5.99 


5.42 


RAMPART - A Modernization 


Contract Services 


Base 


0.02 


- 


- 


Equipment 


Base 


17.00 


5.99 


5.42 


Totals may not add due to rounding. 
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RAMPART-A 
Project Overview 

1 October 2010 
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RAMP ART -A Overview 



<■> Covername for NSA's unconventional special access program 

a to gain access to high-capacity international fiber-optic cables that transit at major 
congestion points around the world. 

<■> Program started in 1992 with the establishment of the National Fiber Optic 
Program Fund 

E3 Four initial global congestion points identified 

E3 Extended Bi-lat partnerships w/FAD to new compartmented efforts 

• General agreements negotiated: 

E3 Foreign Partners provide access to cables and host US equipment 
a US provides equipment for transport, processing, & analysis 
a No US collection by Partner and No Host Country collection by US 
E3 Shared tasking & collection 

• Today—. 

S3 5 on-going relationships 

si-: 2 cooperative relationship (w/ RAM-T) 

S3 2 emerging relationships 
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Project Description 

© (TS//SI) RAMPART-A's accesses target long-haul 
leased communications through international 
gateways. Circuit-Switched and Packet-Switch signals 
are enabled by foreign partners. Collection and 
Processing assets reside on foreign soil and traffic is 
exfilled back to NSAW. 

© (TS//SI) Access Types: International Gateway 
Switches; End-Point GSM Switches; Leased Internet 
Circuits; Internet Backbone Routers; Call Records. 

© (S//SI) Every Country Code in the world is seen at 
one or more RAMPART-A collection accesses 
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SSO/RAMPART-A Site Operations 
Model 



Mission Program Manager 




TOP SECRET//COMINT//NOFORN 




Engineering and Technical Services 

(ETS) 



<•> (U//FOUO) Integrate corporate and commercial 
solutions 

a In compliance with differing Third-party 
architectures 

<•> (C) Test end-to-end integrated solutions to meet SSO 
& Third-party operational requirements 

<•> (C) Deploy and support new systems to Third-party 
controlled facilities 
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Operations and Discovery Division 
(ODD) 

o (C) Responsible for the tasking of the collection 
systems 



(C) Coordinates system resources with the RAMPART- 
A partners 



(C) Analyzes communications links to optimize 
collection resources 



0 (C) Monitors the performance of the collection 
systems 
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RAM- A Projects 

» US-3237/SMOKYSINK (no 3 rd party partner/joint RAM-T) 

a DNR&DNI 

• US-3127 / AZUREPHOENIX 
*3 DNR&DNI 
S US-3180/SPINNERET 
ss DNR&DNI 

« US-982/TRANQUIL - Retired June 2010 
a DNR&DNI 

a US-3 145 / MOON LIGHTPATH 

a DNI & DNR (September 2010) 
a US-3190/ FIREBIRD 
a DNR&DNI 

a US-3153/FALCONSTRIKE 
ss DNR&DNI 
« US-3178/ DULCIMER 
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RAMPART-A Typical Operation 




TOP SECRET//COMINT//NOFORN 




Sensitivity Factors 

® (TS//SI//NF//ECI) Compartmentalization 

c: REDHARVEST/RDV 

• Who is the partner 

• Where is the access 

• What is the access 

® (TS//SI//NF) Cover 

Most RAMPART-A Third-party partners work the fiber projects 
under the cover of an overt Comsat effort 
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Capabilities 

<* (TS//SI) Capabilities: 

Automated, Continuous, High-Speed Survey of Circuit and 
Packet Switched T raffic 

[•i Packet-Switched selection & session collection 

[•i Dial Number Recognition of Circuit-Switched telephony 

© (S//SI) Deploy, and continually upgrade 
Circuit and Packet Switched collection 
architecture to all RAMPART-A sites 
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SIGINT Value Added 

• (TS//SI) Product Lines: All A&P product lines 
use collection from RAMPART-A for SIGINT 
reporting 

• (TS//SI) Productivity/Intelligence gains: Over 
9,000 SIGINT Product Reports written last 
year with ~49% being Single Source Reports 

• (TS//SI) Targets within Accesses: International 
voice & fax telephony; Users of "web 
services" (e.g. -Port 80 e-mail; Chat; VoIP); 
GSM; Calling Card users 



TOP SECRET//COMINT//NOFORN 



SMOKYSINK 



® (TS//SI) SMOKYSINK is in "steady 
state" mode 

® (TS//SI) Continuous TU upgrades 
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AZUREPHOENIX 



*>(S) Site Physical Plant Upgrade 
2010-2011 

• (TS//SI) TU deployment earliest Spring 
2012 ? 

• (TS//SI) Partner working on additional 
accesses 
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SPINNERET 



0 (TS//SI) Cables upgrading with 
additional capacity - RAM-A deploying 
additional resources to accommodate 

0 (TS//SI) 60 Gbps LPT - October 2009 

0 (TS//SI) Additional 60 Gbps LPT 
scheduled for late 2010 
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MOONLIGHTPA TH 

® (S) DNI system deployment - April 2009 

© (TS//SI) New Cable access survey - May 
2009 

• (S) Site B rehab - Winter 2009 

© (TS//SI) New access in Sept. 2010 

© (TS//SI) New DNR/DNI system deployment - 
first phase (DNR) in May 2010. DNI to follow 
TU deployment schedule 
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TRANQUIL 

® (TS//SI) TRANQUIL shut down 
June, 2010 
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FIREBIRD 



*>(TS//SI) Unique 3 rd party enabled 
access - no NSA processing systems 

© (TS//SI) Collection System IOC - 
February 2010 

<•> (TS//SI) Working to establish an NSA to 
3 rd Party partner collection system 
translation 
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FLASHMARK 



*> (TS//SI) Access same as FIREBIRD, but 
allowing US Collection Systems 

<> (TS//SI) Survey - March, 2010 

<•> (TS//SI) FIREBIRD/FLASHMARK issue to 
be resolved this month. 
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FAL CONSTRIKE 

<> (TS//SI) Survey - September 2009 

© (TS//SI) Pilot System Deployment - January 
2010 

• (TS//SI) Secure Comms Deployment - 
January 2010 

<* (TS//SI) Two Track Future 
Sustained system - mid 2012 
Pilot System upgrade completed - December 2010 
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DULCIMER 

• (TS//SI) Survey - November 2010 

• (TS//SI) Expected traffic should be large 
international internet pipes 
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CONDORSPEAK 

<> (TS//SI) Discussions with Partner - October, 
2010 

• (TS//SI) Expected initial traffic will be 
metadata from target cable 
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In Summary 

© RAMPART-A has access to international 
communications from anywhere around 
the world 

© SSO/RAMPART -A stands ready to 
support your intelligence gathering 
needs 
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The Cryptologic Provider of 



Intelligence from G loba l High- Capacity 
Telecommunic ^ ms Systems J> 



TOP SECRET//COMINT//NOFORN 






TOP SECRET//COMINT//NOFORN 



Todays Cable Program 






Three Access 
Portfolios 



Foreign 



RAMPART-A (3rd Party) 
WINDSTOP (2nd Party) 



Unilateral 



Corporate 

BLARNEY- FISA 
FAIRVIEW 
STORMBREW 
OAKSTAR 

PRISM 

FAA 



RAMPART-I/X 
RAMPART-T (ClanSIG) 



MYSTIC 
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UNCLASSIFIED//FOR OFFICIAL USE ONLY 



Got Fiber?? 



WORLDWIDE UNDERSEA FIBEROPTIC 

ROUTES PLANNED AND IN PLACE 



/a 
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Incredible Challenges... top secret//comint//noforn 

How To Find Target Communication on a Typical Fiber Optic Cable? 



1 Cable 12 Fibers 64 wavelengths 




6000 
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International Internet Growth 
(Billions of bits/second) 



10 B bits/Sec 100 Million 

Simultaneous 

Telephone or Internet Sessions 
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SSO Foreign Programs 



Partnering with Foreign SIGINT partners to 
enable access to foreign intelligence 





Partnerships developed jointly with 
Foreign Affairs Directorate 
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RAMPART A 



(TS//SI//NF) Unconventional special access program 
leveraging Third Party partnerships: 

• High-capacity international fiber transiting major 
congestion points around the world 

• Foreign Partners provide access to cables and 
host U.S. equipment 

• U.S. provides equipment for transport, 
processing and analysis 

• No U.S. collection by Partner and No Host 
Country collection by U.S. - there ARE exceptions! 

• Shared tasking and collection 
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Typical RAM-A Configuration 



USA 



RAMPART -A Typical Operation 

Country X 



Site D/E 

NSA 





International Cable 



Site B 

Processing Center 




Site A 

Access Point 



Site C 

Partner Analysts 
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Cable to Database 
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RAMPART A Sites 



■ Five sites, 4 with a Trusted 3rd Party Partner 



■ US-3127 NH AZUREPHOENIX* * - 4mb BW/1 Ogb/day 

■ US-31 45/KX MOONLIGHTPA TH * * - ~2mb BW/5gb/day 

■ US-31 80/9C SPINNERET * - ~45mb BW/35gb/day 

■ US-3237/KE SMOKYSINK ( DNR.DNI ) - ~45mb BW/30gb/day 

■ US-3190/21 FIREBIRD (DNR.DNI)* * - ~2mb BW 



> Partners can view aj[ DNR and DNI tasking. 

Tijry=>i cJssc/ipioxs onb/, xjoi coxxjxxjsxjis/s^psjxjsjoxj 

■ Partners can view DNI traffic via viewer tool. 



^ . 
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The DNI Throttle 



i Implemented on the SMK Xkeyscore that does 
filtering/selection on Dec 2007; Oct 09 at SPIN; 
Feb 2010 SMK LPT 

i Limits ALL Cadence categories to IGb/lOk 
sessions/day at US-3180 and US-3237. 

i Full take stored ONLY on Xkeyscores for ~3 
days. Will have to query Xkeys for any DNI not 
forwarded to Pinwale. 

1 Gb/day may decrease as other RAM A sites 
increase their DNI take. 
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RAM-A Tasking 

i Ops trained/certified before using the system. 

i All DNR/DNI tasking completed by Support 
Hub; RAM-A CM provides support as needed. 

i All DNR/DNI tasking is reviewed and Partner 
offensive tasking deleted. Deletions based on 
our taboo/scrubber lists. Deletes not pushed 
back to TOPIs. 

i TOPIs cannot review DNI categories for all 
sites unless cleared REDHARVEST . 

i Use SMOKYSINK/RAMPART-A to review your 
categories 
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